Description
The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| containernetworking | plugins | >= 1.6.0, < 1.9.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-containernetworking-plugins | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-containernetworking-plugins | No fix yet | — |
| Ubuntu 25.10 | golang-github-containernetworking-plugins | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-containernetworking-plugins | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-containernetworking-plugins | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | golang-github-containernetworking-plugins | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | docker | 29.2.1_ce-37.1 | openSUSE-SU-2026:10261-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20251230T014957-150000.1.134.1 | SUSE-SU-2026:0037-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | singularity | 4.3.6-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | azure-ipam +1 | 0.4.0-r7 | — |
| Wolfi rolling | buildah | 1.42.2-r2 | — |
| Wolfi rolling | buildctl +1 | 0.26.2-r2 | — |
| Wolfi rolling | calico-3.31 +15 | 3.31.2-r4 | — |
| Wolfi rolling | ctr-2 +4 | 2.2.0-r4 | — |
| Wolfi rolling | docker-dind | 28.5.2-r8 | — |
| Wolfi rolling | dogstatsd-7.77 +1 | 7.77.3-r14 | — |
| Wolfi rolling | dogstatsd-7.78 +1 | 7.78.4-r9 | — |
| Wolfi rolling | flannel +1 | 0.27.4-r6 | — |
| Wolfi rolling | istio-pilot-agent-1.25 +1 | 1.25.5-r5 | — |
| Wolfi rolling | k3s +1 | 1.35.0.3-r0 | — |
| Wolfi rolling | k3s-1.32 +1 | 1.32.11.3-r0 | — |
| Wolfi rolling | kuma-2.12 +6 | 2.12.3-r3 | — |
| Wolfi rolling | multus-cni +1 | 4.2.3-r2 | — |
| Wolfi rolling | nerdctl | 2.2.0-r5 | — |
| Wolfi rolling | podman +1 | 5.7.1-r1 | — |
| Wolfi rolling | rootlesskit +1 | 2.3.5-r9 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/containernetworking/plugins | >= 1.6.0, < 1.9.0 | 1.9.0 | GHSA-jv3w-x3r3-g6rm |
Advisories 3
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- openSUSE-SU-2026:10261-1 docker-29.2.1_ce-37.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0037-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 23, 2026